Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
09/05/2024, 01:57
Behavioral task
behavioral1
Sample
9d5f805044b2032451c47a12c8c9baf3bda38d9670ddf62bcd30e465e9164e4b.exe
Resource
win7-20240220-en
6 signatures
150 seconds
General
-
Target
9d5f805044b2032451c47a12c8c9baf3bda38d9670ddf62bcd30e465e9164e4b.exe
-
Size
540KB
-
MD5
872ee778dd8ae35319bc127011e734ee
-
SHA1
78aea52817427d1d8b24f2828a6fcbd617e44507
-
SHA256
9d5f805044b2032451c47a12c8c9baf3bda38d9670ddf62bcd30e465e9164e4b
-
SHA512
4fa12ddd2db2c858909ce2ed380e17dc632a899b692d04bea8ebe094626abbca450f17c1ff5ec19f9b3d5475b2318d63b5efe9a5d40ecaa2fc44583ba4a29cc3
-
SSDEEP
6144:Ucm4FmowdHoSEsIR7DsFhraHcpOaKHpXfRo0V8JcgE+ezpg1xrloBNTNDoDxL:i4wFHoSEsIR7seFaKHpv/VycgE81lg2
Malware Config
Signatures
-
Detect Blackmoon payload 35 IoCs
resource yara_rule behavioral1/memory/2868-8-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral1/memory/2632-68-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral1/memory/2460-84-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral1/memory/1984-184-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral1/memory/1508-309-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral1/memory/2508-323-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral1/memory/2692-335-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral1/memory/2668-369-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral1/memory/880-491-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral1/memory/1208-516-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral1/memory/2216-1097-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral1/memory/588-687-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral1/memory/616-484-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral1/memory/688-449-0x00000000002D0000-0x0000000000305000-memory.dmp family_blackmoon behavioral1/memory/1988-439-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral1/memory/1736-407-0x0000000000370000-0x00000000003A5000-memory.dmp family_blackmoon behavioral1/memory/2724-376-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral1/memory/2900-368-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral1/memory/1184-290-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral1/memory/288-288-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral1/memory/1204-243-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral1/memory/1972-229-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral1/memory/972-218-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral1/memory/2880-175-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral1/memory/1452-166-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral1/memory/2172-132-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral1/memory/2780-122-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral1/memory/2716-112-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral1/memory/2468-102-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral1/memory/2652-59-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral1/memory/2964-50-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral1/memory/2548-40-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral1/memory/2596-38-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral1/memory/2492-27-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral1/memory/2320-11-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon -
UPX dump on OEP (original entry point) 64 IoCs
resource yara_rule behavioral1/memory/2868-0-0x0000000000400000-0x0000000000435000-memory.dmp UPX behavioral1/memory/2868-8-0x0000000000400000-0x0000000000435000-memory.dmp UPX behavioral1/files/0x000c000000012707-6.dat UPX behavioral1/files/0x002f000000014c2d-16.dat UPX behavioral1/memory/2596-30-0x0000000000400000-0x0000000000435000-memory.dmp UPX behavioral1/files/0x00080000000153ee-29.dat UPX behavioral1/files/0x0007000000015662-39.dat UPX behavioral1/files/0x00070000000158d9-47.dat UPX behavioral1/files/0x000a000000015b50-65.dat UPX behavioral1/memory/2632-68-0x0000000000400000-0x0000000000435000-memory.dmp UPX behavioral1/files/0x0009000000015c9a-76.dat UPX behavioral1/memory/2460-84-0x0000000000400000-0x0000000000435000-memory.dmp UPX behavioral1/files/0x0006000000015d9c-94.dat UPX behavioral1/files/0x0006000000015f23-104.dat UPX behavioral1/files/0x0006000000015fa6-114.dat UPX behavioral1/files/0x0006000000016013-124.dat UPX behavioral1/files/0x00060000000161ee-142.dat UPX behavioral1/files/0x00060000000164ec-156.dat UPX behavioral1/files/0x0006000000016575-167.dat UPX behavioral1/files/0x00060000000167bf-176.dat UPX behavioral1/files/0x0006000000016a28-185.dat UPX behavioral1/memory/1984-184-0x0000000000400000-0x0000000000435000-memory.dmp UPX behavioral1/files/0x0006000000016c38-210.dat UPX behavioral1/files/0x0006000000016c84-219.dat UPX behavioral1/files/0x002f000000014f57-246.dat UPX behavioral1/memory/1508-309-0x0000000000400000-0x0000000000435000-memory.dmp UPX behavioral1/memory/2508-316-0x0000000000400000-0x0000000000435000-memory.dmp UPX behavioral1/memory/2508-323-0x0000000000400000-0x0000000000435000-memory.dmp UPX behavioral1/memory/2692-335-0x0000000000400000-0x0000000000435000-memory.dmp UPX behavioral1/memory/2668-369-0x0000000000400000-0x0000000000435000-memory.dmp UPX behavioral1/memory/1628-440-0x0000000000400000-0x0000000000435000-memory.dmp UPX behavioral1/memory/880-491-0x0000000000400000-0x0000000000435000-memory.dmp UPX behavioral1/memory/1208-516-0x0000000000400000-0x0000000000435000-memory.dmp UPX behavioral1/memory/2620-554-0x0000000000400000-0x0000000000435000-memory.dmp UPX behavioral1/memory/2396-573-0x0000000000400000-0x0000000000435000-memory.dmp UPX behavioral1/memory/352-606-0x0000000000400000-0x0000000000435000-memory.dmp UPX behavioral1/memory/2016-650-0x0000000000400000-0x0000000000435000-memory.dmp UPX behavioral1/memory/2688-791-0x0000000000400000-0x0000000000435000-memory.dmp UPX behavioral1/memory/1268-874-0x0000000000400000-0x0000000000435000-memory.dmp UPX behavioral1/memory/768-911-0x0000000000400000-0x0000000000435000-memory.dmp UPX behavioral1/memory/1204-944-0x0000000000400000-0x0000000000435000-memory.dmp UPX behavioral1/memory/2540-1013-0x0000000000400000-0x0000000000435000-memory.dmp UPX behavioral1/memory/360-1058-0x0000000000400000-0x0000000000435000-memory.dmp UPX behavioral1/memory/2216-1097-0x0000000000400000-0x0000000000435000-memory.dmp UPX behavioral1/memory/352-1083-0x0000000000400000-0x0000000000435000-memory.dmp UPX behavioral1/memory/2964-1050-0x0000000000400000-0x0000000000435000-memory.dmp UPX behavioral1/memory/2908-1000-0x0000000000400000-0x0000000000435000-memory.dmp UPX behavioral1/memory/1188-931-0x0000000000400000-0x0000000000435000-memory.dmp UPX behavioral1/memory/1548-918-0x0000000000400000-0x0000000000435000-memory.dmp UPX behavioral1/memory/1640-867-0x0000000000400000-0x0000000000435000-memory.dmp UPX behavioral1/memory/2720-830-0x0000000000400000-0x0000000000435000-memory.dmp UPX behavioral1/memory/2292-817-0x0000000000400000-0x0000000000435000-memory.dmp UPX behavioral1/memory/2512-798-0x0000000000400000-0x0000000000435000-memory.dmp UPX behavioral1/memory/2316-778-0x0000000000400000-0x0000000000435000-memory.dmp UPX behavioral1/memory/2296-756-0x0000000000400000-0x0000000000435000-memory.dmp UPX behavioral1/memory/952-725-0x0000000000400000-0x0000000000435000-memory.dmp UPX behavioral1/memory/588-687-0x0000000000400000-0x0000000000435000-memory.dmp UPX behavioral1/memory/1636-631-0x0000000000400000-0x0000000000435000-memory.dmp UPX behavioral1/memory/1944-587-0x0000000000400000-0x0000000000435000-memory.dmp UPX behavioral1/memory/1516-529-0x0000000000400000-0x0000000000435000-memory.dmp UPX behavioral1/memory/616-484-0x0000000000400000-0x0000000000435000-memory.dmp UPX behavioral1/memory/688-449-0x00000000002D0000-0x0000000000305000-memory.dmp UPX behavioral1/memory/1988-439-0x0000000000400000-0x0000000000435000-memory.dmp UPX behavioral1/memory/2004-420-0x0000000000400000-0x0000000000435000-memory.dmp UPX -
Executes dropped EXE 64 IoCs
pid Process 2320 flxllff.exe 2492 hbnnnb.exe 2596 jdpdp.exe 2548 7xfxfff.exe 2964 rlrxxrx.exe 2652 bhhbth.exe 2632 vpvdj.exe 2460 fxffrrr.exe 1780 hbttbt.exe 2468 vppdj.exe 2716 xlrlrrr.exe 2780 3lfrxfr.exe 2172 nbhhhh.exe 1736 vpjpv.exe 1260 xxlrxxf.exe 2788 thnnbt.exe 1452 jddjp.exe 2880 dvjvd.exe 1984 xrlxrlf.exe 1896 htbtbt.exe 1832 jdvdp.exe 1960 flxxxxf.exe 972 xlrrxxl.exe 2068 nbhnth.exe 1972 jvjjp.exe 1204 lflflfl.exe 1524 nhthnt.exe 1012 1pddj.exe 1900 rfrxxlr.exe 2480 tnhhtb.exe 288 pjpvd.exe 1184 lxfllll.exe 1976 5lfflrr.exe 1508 hhtbhb.exe 2268 pdppp.exe 2508 3rffxxl.exe 2256 5hnnnn.exe 2692 djjpv.exe 2696 pjjjd.exe 2804 ffrxfrx.exe 2652 nbnhnt.exe 2292 vvppv.exe 2900 xxrlflx.exe 2668 rllfxxx.exe 2724 bttntt.exe 2760 pppdp.exe 1560 vpdjj.exe 2172 fxrrxfl.exe 1736 9xxfrrx.exe 1248 hthhnn.exe 2020 vppvp.exe 2004 vvpdp.exe 1760 xrfxlrl.exe 1988 lfxxflf.exe 1628 hhbhnt.exe 688 ttbbth.exe 324 vvpdp.exe 1704 xrflrxl.exe 1708 rrrxlxl.exe 3020 bbtbnn.exe 1868 dvddj.exe 616 vpjvj.exe 880 fxflrxf.exe 1608 bnbtnh.exe -
resource yara_rule behavioral1/memory/2868-0-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral1/memory/2868-8-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral1/files/0x000c000000012707-6.dat upx behavioral1/files/0x002f000000014c2d-16.dat upx behavioral1/memory/2596-30-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral1/files/0x00080000000153ee-29.dat upx behavioral1/files/0x0007000000015662-39.dat upx behavioral1/files/0x00070000000158d9-47.dat upx behavioral1/files/0x000a000000015b50-65.dat upx behavioral1/memory/2632-68-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral1/files/0x0009000000015c9a-76.dat upx behavioral1/memory/2460-84-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral1/files/0x0006000000015d9c-94.dat upx behavioral1/files/0x0006000000015f23-104.dat upx behavioral1/files/0x0006000000015fa6-114.dat upx behavioral1/files/0x0006000000016013-124.dat upx behavioral1/files/0x00060000000161ee-142.dat upx behavioral1/files/0x00060000000164ec-156.dat upx behavioral1/files/0x0006000000016575-167.dat upx behavioral1/files/0x00060000000167bf-176.dat upx behavioral1/files/0x0006000000016a28-185.dat upx behavioral1/memory/1984-184-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral1/files/0x0006000000016c38-210.dat upx behavioral1/files/0x0006000000016c84-219.dat upx behavioral1/files/0x002f000000014f57-246.dat upx behavioral1/memory/1508-309-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral1/memory/2508-316-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral1/memory/2508-323-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral1/memory/2692-335-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral1/memory/2668-369-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral1/memory/1628-440-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral1/memory/880-491-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral1/memory/1208-516-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral1/memory/2620-554-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral1/memory/2396-573-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral1/memory/352-606-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral1/memory/2016-650-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral1/memory/2688-791-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral1/memory/1268-874-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral1/memory/768-911-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral1/memory/1204-944-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral1/memory/2540-1013-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral1/memory/360-1058-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral1/memory/2216-1097-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral1/memory/352-1083-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral1/memory/2964-1055-0x00000000001B0000-0x00000000001E5000-memory.dmp upx behavioral1/memory/2964-1050-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral1/memory/2908-1000-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral1/memory/1188-931-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral1/memory/1548-918-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral1/memory/1640-867-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral1/memory/2720-830-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral1/memory/2292-817-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral1/memory/2512-798-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral1/memory/2316-778-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral1/memory/2296-756-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral1/memory/952-725-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral1/memory/588-687-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral1/memory/1636-631-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral1/memory/1944-587-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral1/memory/1516-529-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral1/memory/616-484-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral1/memory/688-449-0x00000000002D0000-0x0000000000305000-memory.dmp upx behavioral1/memory/1988-439-0x0000000000400000-0x0000000000435000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2868 wrote to memory of 2320 2868 9d5f805044b2032451c47a12c8c9baf3bda38d9670ddf62bcd30e465e9164e4b.exe 98 PID 2868 wrote to memory of 2320 2868 9d5f805044b2032451c47a12c8c9baf3bda38d9670ddf62bcd30e465e9164e4b.exe 98 PID 2868 wrote to memory of 2320 2868 9d5f805044b2032451c47a12c8c9baf3bda38d9670ddf62bcd30e465e9164e4b.exe 98 PID 2868 wrote to memory of 2320 2868 9d5f805044b2032451c47a12c8c9baf3bda38d9670ddf62bcd30e465e9164e4b.exe 98 PID 2320 wrote to memory of 2492 2320 flxllff.exe 29 PID 2320 wrote to memory of 2492 2320 flxllff.exe 29 PID 2320 wrote to memory of 2492 2320 flxllff.exe 29 PID 2320 wrote to memory of 2492 2320 flxllff.exe 29 PID 2492 wrote to memory of 2596 2492 hbnnnb.exe 30 PID 2492 wrote to memory of 2596 2492 hbnnnb.exe 30 PID 2492 wrote to memory of 2596 2492 hbnnnb.exe 30 PID 2492 wrote to memory of 2596 2492 hbnnnb.exe 30 PID 2596 wrote to memory of 2548 2596 jdpdp.exe 31 PID 2596 wrote to memory of 2548 2596 jdpdp.exe 31 PID 2596 wrote to memory of 2548 2596 jdpdp.exe 31 PID 2596 wrote to memory of 2548 2596 jdpdp.exe 31 PID 2548 wrote to memory of 2964 2548 7xfxfff.exe 32 PID 2548 wrote to memory of 2964 2548 7xfxfff.exe 32 PID 2548 wrote to memory of 2964 2548 7xfxfff.exe 32 PID 2548 wrote to memory of 2964 2548 7xfxfff.exe 32 PID 2964 wrote to memory of 2652 2964 rlrxxrx.exe 68 PID 2964 wrote to memory of 2652 2964 rlrxxrx.exe 68 PID 2964 wrote to memory of 2652 2964 rlrxxrx.exe 68 PID 2964 wrote to memory of 2652 2964 rlrxxrx.exe 68 PID 2652 wrote to memory of 2632 2652 bhhbth.exe 34 PID 2652 wrote to memory of 2632 2652 bhhbth.exe 34 PID 2652 wrote to memory of 2632 2652 bhhbth.exe 34 PID 2652 wrote to memory of 2632 2652 bhhbth.exe 34 PID 2632 wrote to memory of 2460 2632 vpvdj.exe 35 PID 2632 wrote to memory of 2460 2632 vpvdj.exe 35 PID 2632 wrote to memory of 2460 2632 vpvdj.exe 35 PID 2632 wrote to memory of 2460 2632 vpvdj.exe 35 PID 2460 wrote to memory of 1780 2460 fxffrrr.exe 36 PID 2460 wrote to memory of 1780 2460 fxffrrr.exe 36 PID 2460 wrote to memory of 1780 2460 fxffrrr.exe 36 PID 2460 wrote to memory of 1780 2460 fxffrrr.exe 36 PID 1780 wrote to memory of 2468 1780 hbttbt.exe 37 PID 1780 wrote to memory of 2468 1780 hbttbt.exe 37 PID 1780 wrote to memory of 2468 1780 hbttbt.exe 37 PID 1780 wrote to memory of 2468 1780 hbttbt.exe 37 PID 2468 wrote to memory of 2716 2468 vppdj.exe 38 PID 2468 wrote to memory of 2716 2468 vppdj.exe 38 PID 2468 wrote to memory of 2716 2468 vppdj.exe 38 PID 2468 wrote to memory of 2716 2468 vppdj.exe 38 PID 2716 wrote to memory of 2780 2716 xlrlrrr.exe 39 PID 2716 wrote to memory of 2780 2716 xlrlrrr.exe 39 PID 2716 wrote to memory of 2780 2716 xlrlrrr.exe 39 PID 2716 wrote to memory of 2780 2716 xlrlrrr.exe 39 PID 2780 wrote to memory of 2172 2780 3lfrxfr.exe 40 PID 2780 wrote to memory of 2172 2780 3lfrxfr.exe 40 PID 2780 wrote to memory of 2172 2780 3lfrxfr.exe 40 PID 2780 wrote to memory of 2172 2780 3lfrxfr.exe 40 PID 2172 wrote to memory of 1736 2172 nbhhhh.exe 41 PID 2172 wrote to memory of 1736 2172 nbhhhh.exe 41 PID 2172 wrote to memory of 1736 2172 nbhhhh.exe 41 PID 2172 wrote to memory of 1736 2172 nbhhhh.exe 41 PID 1736 wrote to memory of 1260 1736 vpjpv.exe 42 PID 1736 wrote to memory of 1260 1736 vpjpv.exe 42 PID 1736 wrote to memory of 1260 1736 vpjpv.exe 42 PID 1736 wrote to memory of 1260 1736 vpjpv.exe 42 PID 1260 wrote to memory of 2788 1260 xxlrxxf.exe 43 PID 1260 wrote to memory of 2788 1260 xxlrxxf.exe 43 PID 1260 wrote to memory of 2788 1260 xxlrxxf.exe 43 PID 1260 wrote to memory of 2788 1260 xxlrxxf.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\9d5f805044b2032451c47a12c8c9baf3bda38d9670ddf62bcd30e465e9164e4b.exe"C:\Users\Admin\AppData\Local\Temp\9d5f805044b2032451c47a12c8c9baf3bda38d9670ddf62bcd30e465e9164e4b.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2868 -
\??\c:\flxllff.exec:\flxllff.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2320 -
\??\c:\hbnnnb.exec:\hbnnnb.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2492 -
\??\c:\jdpdp.exec:\jdpdp.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2596 -
\??\c:\7xfxfff.exec:\7xfxfff.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2548 -
\??\c:\rlrxxrx.exec:\rlrxxrx.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2964 -
\??\c:\bhhbth.exec:\bhhbth.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2652 -
\??\c:\vpvdj.exec:\vpvdj.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2632 -
\??\c:\fxffrrr.exec:\fxffrrr.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2460 -
\??\c:\hbttbt.exec:\hbttbt.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1780 -
\??\c:\vppdj.exec:\vppdj.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2468 -
\??\c:\xlrlrrr.exec:\xlrlrrr.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2716 -
\??\c:\3lfrxfr.exec:\3lfrxfr.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2780 -
\??\c:\nbhhhh.exec:\nbhhhh.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2172 -
\??\c:\vpjpv.exec:\vpjpv.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1736 -
\??\c:\xxlrxxf.exec:\xxlrxxf.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1260 -
\??\c:\thnnbt.exec:\thnnbt.exe17⤵
- Executes dropped EXE
PID:2788 -
\??\c:\jddjp.exec:\jddjp.exe18⤵
- Executes dropped EXE
PID:1452 -
\??\c:\dvjvd.exec:\dvjvd.exe19⤵
- Executes dropped EXE
PID:2880 -
\??\c:\xrlxrlf.exec:\xrlxrlf.exe20⤵
- Executes dropped EXE
PID:1984 -
\??\c:\htbtbt.exec:\htbtbt.exe21⤵
- Executes dropped EXE
PID:1896 -
\??\c:\jdvdp.exec:\jdvdp.exe22⤵
- Executes dropped EXE
PID:1832 -
\??\c:\flxxxxf.exec:\flxxxxf.exe23⤵
- Executes dropped EXE
PID:1960 -
\??\c:\xlrrxxl.exec:\xlrrxxl.exe24⤵
- Executes dropped EXE
PID:972 -
\??\c:\nbhnth.exec:\nbhnth.exe25⤵
- Executes dropped EXE
PID:2068 -
\??\c:\jvjjp.exec:\jvjjp.exe26⤵
- Executes dropped EXE
PID:1972 -
\??\c:\lflflfl.exec:\lflflfl.exe27⤵
- Executes dropped EXE
PID:1204 -
\??\c:\nhthnt.exec:\nhthnt.exe28⤵
- Executes dropped EXE
PID:1524 -
\??\c:\1pddj.exec:\1pddj.exe29⤵
- Executes dropped EXE
PID:1012 -
\??\c:\rfrxxlr.exec:\rfrxxlr.exe30⤵
- Executes dropped EXE
PID:1900 -
\??\c:\tnhhtb.exec:\tnhhtb.exe31⤵
- Executes dropped EXE
PID:2480 -
\??\c:\pjpvd.exec:\pjpvd.exe32⤵
- Executes dropped EXE
PID:288 -
\??\c:\lxfllll.exec:\lxfllll.exe33⤵
- Executes dropped EXE
PID:1184 -
\??\c:\5lfflrr.exec:\5lfflrr.exe34⤵
- Executes dropped EXE
PID:1976 -
\??\c:\hhtbhb.exec:\hhtbhb.exe35⤵
- Executes dropped EXE
PID:1508 -
\??\c:\pdppp.exec:\pdppp.exe36⤵
- Executes dropped EXE
PID:2268 -
\??\c:\3rffxxl.exec:\3rffxxl.exe37⤵
- Executes dropped EXE
PID:2508 -
\??\c:\5hnnnn.exec:\5hnnnn.exe38⤵
- Executes dropped EXE
PID:2256 -
\??\c:\djjpv.exec:\djjpv.exe39⤵
- Executes dropped EXE
PID:2692 -
\??\c:\pjjjd.exec:\pjjjd.exe40⤵
- Executes dropped EXE
PID:2696 -
\??\c:\ffrxfrx.exec:\ffrxfrx.exe41⤵
- Executes dropped EXE
PID:2804 -
\??\c:\nbnhnt.exec:\nbnhnt.exe42⤵
- Executes dropped EXE
PID:2652 -
\??\c:\vvppv.exec:\vvppv.exe43⤵
- Executes dropped EXE
PID:2292 -
\??\c:\xxrlflx.exec:\xxrlflx.exe44⤵
- Executes dropped EXE
PID:2900 -
\??\c:\rllfxxx.exec:\rllfxxx.exe45⤵
- Executes dropped EXE
PID:2668 -
\??\c:\bttntt.exec:\bttntt.exe46⤵
- Executes dropped EXE
PID:2724 -
\??\c:\pppdp.exec:\pppdp.exe47⤵
- Executes dropped EXE
PID:2760 -
\??\c:\vpdjj.exec:\vpdjj.exe48⤵
- Executes dropped EXE
PID:1560 -
\??\c:\fxrrxfl.exec:\fxrrxfl.exe49⤵
- Executes dropped EXE
PID:2172 -
\??\c:\9xxfrrx.exec:\9xxfrrx.exe50⤵
- Executes dropped EXE
PID:1736 -
\??\c:\hthhnn.exec:\hthhnn.exe51⤵
- Executes dropped EXE
PID:1248 -
\??\c:\vppvp.exec:\vppvp.exe52⤵
- Executes dropped EXE
PID:2020 -
\??\c:\vvpdp.exec:\vvpdp.exe53⤵
- Executes dropped EXE
PID:2004 -
\??\c:\xrfxlrl.exec:\xrfxlrl.exe54⤵
- Executes dropped EXE
PID:1760 -
\??\c:\lfxxflf.exec:\lfxxflf.exe55⤵
- Executes dropped EXE
PID:1988 -
\??\c:\hhbhnt.exec:\hhbhnt.exe56⤵
- Executes dropped EXE
PID:1628 -
\??\c:\ttbbth.exec:\ttbbth.exe57⤵
- Executes dropped EXE
PID:688 -
\??\c:\vvpdp.exec:\vvpdp.exe58⤵
- Executes dropped EXE
PID:324 -
\??\c:\xrflrxl.exec:\xrflrxl.exe59⤵
- Executes dropped EXE
PID:1704 -
\??\c:\rrrxlxl.exec:\rrrxlxl.exe60⤵
- Executes dropped EXE
PID:1708 -
\??\c:\bbtbnn.exec:\bbtbnn.exe61⤵
- Executes dropped EXE
PID:3020 -
\??\c:\dvddj.exec:\dvddj.exe62⤵
- Executes dropped EXE
PID:1868 -
\??\c:\vpjvj.exec:\vpjvj.exe63⤵
- Executes dropped EXE
PID:616 -
\??\c:\fxflrxf.exec:\fxflrxf.exe64⤵
- Executes dropped EXE
PID:880 -
\??\c:\bnbtnh.exec:\bnbtnh.exe65⤵
- Executes dropped EXE
PID:1608 -
\??\c:\hhthbt.exec:\hhthbt.exe66⤵PID:1900
-
\??\c:\jjdpp.exec:\jjdpp.exe67⤵PID:1176
-
\??\c:\rlrfllx.exec:\rlrfllx.exe68⤵PID:1208
-
\??\c:\7bhntb.exec:\7bhntb.exe69⤵PID:1956
-
\??\c:\jvpdp.exec:\jvpdp.exe70⤵PID:1516
-
\??\c:\ppjdp.exec:\ppjdp.exe71⤵PID:1512
-
\??\c:\fxlxflx.exec:\fxlxflx.exe72⤵PID:2320
-
\??\c:\1xlrxxl.exec:\1xlrxxl.exe73⤵PID:2844
-
\??\c:\ttthnt.exec:\ttthnt.exe74⤵PID:2620
-
\??\c:\jjvjv.exec:\jjvjv.exe75⤵PID:1028
-
\??\c:\1vvvj.exec:\1vvvj.exe76⤵PID:2424
-
\??\c:\xrrxflx.exec:\xrrxflx.exe77⤵PID:2396
-
\??\c:\lxflxfx.exec:\lxflxfx.exe78⤵PID:2520
-
\??\c:\thbhnn.exec:\thbhnn.exe79⤵PID:1944
-
\??\c:\vdpdv.exec:\vdpdv.exe80⤵PID:1780
-
\??\c:\9lffllr.exec:\9lffllr.exe81⤵PID:2732
-
\??\c:\bthnth.exec:\bthnth.exe82⤵PID:352
-
\??\c:\nnhthh.exec:\nnhthh.exe83⤵PID:2756
-
\??\c:\pjvdj.exec:\pjvdj.exe84⤵PID:2760
-
\??\c:\rrlfrrr.exec:\rrlfrrr.exe85⤵PID:1560
-
\??\c:\9nnbtn.exec:\9nnbtn.exe86⤵PID:1636
-
\??\c:\btbnbn.exec:\btbnbn.exe87⤵PID:2288
-
\??\c:\9jdpv.exec:\9jdpv.exe88⤵PID:2456
-
\??\c:\5vvdv.exec:\5vvdv.exe89⤵PID:2016
-
\??\c:\5fxxrfl.exec:\5fxxrfl.exe90⤵PID:1996
-
\??\c:\frxxlrf.exec:\frxxlrf.exe91⤵PID:2224
-
\??\c:\hbtthh.exec:\hbtthh.exe92⤵PID:2212
-
\??\c:\dvvdj.exec:\dvvdj.exe93⤵PID:1832
-
\??\c:\7vpdj.exec:\7vpdj.exe94⤵PID:588
-
\??\c:\ffxfrxr.exec:\ffxfrxr.exe95⤵PID:972
-
\??\c:\1thtnb.exec:\1thtnb.exe96⤵PID:1396
-
\??\c:\nhbthn.exec:\nhbthn.exe97⤵PID:2864
-
\??\c:\pvjpv.exec:\pvjpv.exe98⤵PID:384
-
\??\c:\jjjvj.exec:\jjjvj.exe99⤵PID:1008
-
\??\c:\fxrfrrx.exec:\fxrfrrx.exe100⤵PID:1656
-
\??\c:\9rrflrl.exec:\9rrflrl.exe101⤵PID:952
-
\??\c:\btnhbh.exec:\btnhbh.exe102⤵PID:1608
-
\??\c:\vvpjv.exec:\vvpjv.exe103⤵PID:1900
-
\??\c:\ppdpd.exec:\ppdpd.exe104⤵PID:2816
-
\??\c:\xxlfxfr.exec:\xxlfxfr.exe105⤵PID:2552
-
\??\c:\rrflrxf.exec:\rrflrxf.exe106⤵PID:2296
-
\??\c:\7nnhth.exec:\7nnhth.exe107⤵PID:2916
-
\??\c:\9nntbt.exec:\9nntbt.exe108⤵PID:1516
-
\??\c:\pjjpv.exec:\pjjpv.exe109⤵PID:1732
-
\??\c:\lffrxfr.exec:\lffrxfr.exe110⤵PID:2316
-
\??\c:\1xrfrrf.exec:\1xrfrrf.exe111⤵PID:2596
-
\??\c:\hhbhbh.exec:\hhbhbh.exe112⤵PID:2688
-
\??\c:\7pvjp.exec:\7pvjp.exe113⤵PID:2512
-
\??\c:\jdvjp.exec:\jdvjp.exe114⤵PID:2964
-
\??\c:\llfrxxl.exec:\llfrxxl.exe115⤵PID:2396
-
\??\c:\xxrrxfr.exec:\xxrrxfr.exe116⤵PID:2292
-
\??\c:\bththt.exec:\bththt.exe117⤵PID:1944
-
\??\c:\pjvjp.exec:\pjvjp.exe118⤵PID:2720
-
\??\c:\ddvpp.exec:\ddvpp.exe119⤵PID:2716
-
\??\c:\3lxxflr.exec:\3lxxflr.exe120⤵PID:2888
-
\??\c:\rlxxrrl.exec:\rlxxrrl.exe121⤵PID:328
-
\??\c:\tnthnt.exec:\tnthnt.exe122⤵PID:2420
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-